Self-Healing Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:03 AM UTC
• Version: 1.0.0

Overview

This self-healing skill is understandable for its purpose, but it can repeatedly change OpenClaw config, memory, sessions, and cron behavior without enough user control or rollback safeguards.

Install only if you are comfortable with a tool that can automatically modify OpenClaw files and run repair actions. Prefer dry-run/check mode first, avoid continuous monitor mode until paths and repair behavior are reviewed, and keep backups of ~/.openclaw/openclaw.json, memory, and sessions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/self-healing-agent.py:235

Finding

Non-Atomic In-Place Repair Can Corrupt the OpenClaw Configuration

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/self-healing-agent.py:168

Finding

Fixed Backup Name and Non-Atomic Truncation Can Cause Irrecoverable Memory Loss

Content

View full analysis

200: with open(path, 'w') as wf: wf.write(f"\n") wf.writelines(lines[-200:]) return True, f"Archived to {archive}, kept last 200 lines" except IOError as e: return False, str(e) return fix ``` ### Technical Analysis Every repair of a particular memory file uses the same backup name, `.archived`. `shutil.copy2()` therefore overwrites the previous backup on subsequent runs. This removes backup version history and can replace a known-good archive with a later damaged or incomplete source file. After creating the backup, the function opens the active memory file with mode `w` and rewrites only the final 200 lines. This operation is non-atomic: the original is truncated before the reduced content has been fully persisted. There is no post-write validation, filesystem synchronization, or rollback procedure. The operation may execute automatically in `monitor` mode. Consequently, a size threshold alone can trigger destructive modification of persistent Agent memory without operator confirmation. ### Attack Path 1. A memory Markdown file grows beyond the configured 1 MB threshold, either naturally or through repeated insertion of content. 2. The operator runs `heal`, or `monitor` detects the oversized file automatically. 3. The current file is copied to the fixed `.archived` path. 4. The a ...[truncated 1178 chars]

Remediation

View remediation

other

Note

• Location: scripts/self-healing-agent.py:288

Finding

Session Check Captures an Unnecessarily Broad Host Process Listing

Content

View full analysis

' in line) if zombie_count > 5: issues.append(Issue( 'sessions', 'warning', f'{zombie_count} zombie processes detected', 'Zombie processes consume PIDs. Consider reaping.', )) except (subprocess.TimeoutExpired, FileNotFoundError): pass ``` ### Technical Analysis The session-health check executes `ps aux` and captures the full process listing visible to the running user. This can include unrelated processes, usernames, resource usage, and complete command lines. Command-line arguments sometimes contain file paths, tokens, connection strings, or other sensitive operational values. The function only needs process-state information to count zombies, so capturing complete command lines for all visible host processes violates data-minimization and least-privilege principles. The current implementation does not log or transmit the captured process output, which substantially limits immediate impact. Nevertheless, the data temporarily resides in the Skill process memory and broadens the information exposed if the process is debugged, inspected, or later modified. ### Attack Path 1. A user invokes `check`, `heal`, or `monitor`; each applicable path calls `check_sessions()`. 2. The Skill executes `ps aux`. 3. The operating system returns all processes visible under the host's process-visibility policy, including command-line arguments. 4. The complete output is captured in `result.stdout`. 5. The code scans the capt ...[truncated 834 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises operational behaviors that imply shell execution and file read/write capability, but it does not declare any explicit tool scope or permissions boundary. For a self-healing skill that can restart jobs, edit configs, restore files, and monitor continuously, missing scope is dangerous because it obscures the blast radius and could let an agent invoke powerful actions without clear least-privilege constraints or user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly describes autonomous repair actions such as restarting cron jobs, fixing config files, restoring files from git history, killing processes, rotating logs, and switching endpoints, yet it does not provide a prominent warning about system-impacting changes or require human approval. In the context of a self-healing agent, this is especially risky because automation is continuous and could amplify mistakes, causing service disruption, data loss, config corruption, or unsafe recovery loops across the host environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/self-healing-agent.py (reported line 109)May include surrounding context.

python

issues = []

    try:
        result = subprocess.run(
            ['openclaw', 'cron', 'list', '--json'],
            capture_output=True, text=True, timeout=15
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/self-healing-agent.py (reported line 133)May include surrounding context.

python

def make_fix(job_id=job.get('id')):
                    def fix():
                        try:
                            r = subprocess.run(
                                ['openclaw', 'cron', 'run', job_id],
                                capture_output=True, text=True, timeout=30
                            )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The auto-heal routine silently archives and truncates memory files, changing user data without confirmation. Even though intended as maintenance, unattended modification can destroy context, interfere with other tools, and be abused in a failure scenario to erase forensic evidence or important operational history.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Automatically rewriting a primary configuration file based on a regex heuristic is dangerous because malformed edits can corrupt settings, change behavior unexpectedly, or make recovery harder. Since this runs as a repair action, users may not notice that a critical config was altered until service behavior changes or additional failures occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script automatically moves session files once they cross a size threshold, which can abruptly disrupt active workflows and remove data from expected locations without consent. In a continuous monitor context, this can cause denial of service to legitimate sessions and hamper incident reconstruction.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/self-healing-agent.py (reported line 328)May include surrounding context.

python

# Check for zombie processes
    try:
        result = subprocess.run(
            ['ps', 'aux'], capture_output=True, text=True, timeout=5
        )
        if result.returncode == 0:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/self-healing-agent.py (reported line 373)May include surrounding context.

python

if os.path.isdir(scripts_dir):
            for py_file in glob.glob(os.path.join(scripts_dir, "*.py")):
                try:
                    result = subprocess.run(
                        ['python3', '-m', 'py_compile', py_file],
                        capture_output=True, text=True, timeout=10
                    )

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill performs outbound network checks to third-party services unrelated to local self-repair, expanding its trust boundary and creating unnecessary external signaling. In some environments this can leak usage patterns, violate network isolation expectations, or trigger unintended egress from a supposedly local maintenance tool.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/self-healing-agent.py (reported line 401)May include surrounding context.

python

for url, name in endpoints:
        try:
            result = subprocess.run(
                ['curl', '-s', '-o', '/dev/null', '-w', '%{http_code}', '--max-time', '5', url],
                capture_output=True, text=True, timeout=10
            )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Monitor mode continuously performs auto-healing actions, including file rewrites and session moves, without an explicit safety warning or approval step. This turns a diagnostic tool into an autonomous mutator, increasing the blast radius of false positives, logic errors, or adversarially induced states because changes recur repeatedly over time.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The stated purpose is OpenClaw agent health monitoring and repair. Running ps aux inspects the host's global process table, which is a broader system-observation capability not clearly justified by the manifest's agent-scoped failure modes and is not tied to identifying OpenClaw-specific processes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.